CVE-2018-2503

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-11 · updated 2026-06-17
Weakness: CWE-862

Description

By default, the SAP NetWeaver AS Java keystore service does not sufficiently restrict the access to resources that should be protected. This has been fixed in SAP NetWeaver AS Java (ServerCore versions 7.11, 7.20, 7.30, 7.31, 7.40, 7.50).

Affected products

SAP NetWeaver AS Java: 7.11, 7.20, 7.30, 7.31, 7.40, 7.50

References

http://www.securityfocus.com/bid/106156
https://launchpad.support.sap.com/#/notes/2658279
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699
http://www.securityfocus.com/bid/106156
https://launchpad.support.sap.com/#/notes/2658279
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=508559699

Get alerted when CVE-2018-2503 or the next vulnerability affects your stack